traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

#4317: Fix an Array Bounds Read in imageop.rgb2rgb8. 

Will backport to 2.4.
This commit is contained in:
Amaury Forgeot d'Arc 2008-11-18 22:19:37 +00:00
parent 273c233c78
commit 7cfe7ea745
3 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Lib/test/test_imageop.py
View File

@ -15,6 +15,7 @@ SIZES = (1, 2, 3, 4)
_VALUES = (1, 2, 2**10, 2**15-1, 2**15, 2**15+1, 2**31-2, 2**31-1) _VALUES = (1, 2, 2**10, 2**15-1, 2**15, 2**15+1, 2**31-2, 2**31-1)
VALUES = tuple( -x for x in reversed(_VALUES) ) + (0,) + _VALUES VALUES = tuple( -x for x in reversed(_VALUES) ) + (0,) + _VALUES
AAAAA = "A" * 1024 AAAAA = "A" * 1024
MAX_LEN = 2**20
class InputValidationTests(unittest.TestCase): class InputValidationTests(unittest.TestCase):
@ -26,7 +27,7 @@ class InputValidationTests(unittest.TestCase):
strlen = abs(width * height) strlen = abs(width * height)
if size: if size:
strlen *= size strlen *= size
if strlen < 1024: if strlen < MAX_LEN:
data = "A" * strlen data = "A" * strlen
else: else:
data = AAAAA data = AAAAA

2
Misc/NEWS
View File

@ -12,6 +12,8 @@ What's New in Python 2.7 alpha 1
Core and Builtins Core and Builtins
----------------- -----------------
- Issue #4317: Fixed a crash in the imageop.rgb2rgb8() function.
- Issue #4230: If ``__getattr__`` is a descriptor, it now functions correctly. - Issue #4230: If ``__getattr__`` is a descriptor, it now functions correctly.
- Issue #4048: The parser module now correctly validates relative imports. - Issue #4048: The parser module now correctly validates relative imports.

2
Modules/imageop.c
View File

@ -590,7 +590,7 @@ imageop_rgb2rgb8(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) ) if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
return 0; return 0;
if ( !check_multiply_size(len*4, x, "x", y, "y", 4) ) if ( !check_multiply_size(len, x, "x", y, "y", 4) )
return 0; return 0;
nlen = x*y; nlen = x*y;
if ( !check_multiply(nlen, x, y) ) if ( !check_multiply(nlen, x, y) )